lkml.org 
[lkml]   [2017]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] nfsd: avoid out of bounds read on array nfsd4_layout_ops
Date

> On 10.5.2017, at 0.14, Colin Ian King <colin.king@canonical.com> wrote:
>
> On 09/05/17 22:03, J . Bruce Fields wrote:
>> On Tue, May 09, 2017 at 05:04:14PM +0300, Dan Carpenter wrote:
>>> On Tue, May 09, 2017 at 02:31:21PM +0100, Colin King wrote:
>>>> diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
>>>> index 1dbf62190bee..c453a1998e00 100644
>>>> --- a/fs/nfsd/nfs4proc.c
>>>> +++ b/fs/nfsd/nfs4proc.c
>>>> @@ -1259,7 +1259,8 @@ nfsd4_layout_verify(struct svc_export *exp, unsigned int layout_type)
>>>> return NULL;
>>>> }
>>>>
>>>> - if (layout_type >= 32 || !(exp->ex_layout_types & (1 << layout_type))) {
>>>> + if (layout_type >= LAYOUT_TYPE_MAX ||
>>>> + !(exp->ex_layout_types & (1 << layout_type))) {
>>>
>>> The 32 is there to prevent a shift wrapping bug. The bit test prevents
>>> a buffer overflow so this can't actually overflow.
>>
>> Yes, looks like a false positive for coverity.
>>
>>> But this change doesn't hurt and is probably cleaner.
>>
>> Sure. Hope it's OK if I just merge this into the previous commit:
>
> Fine by me. Colin

Looks good to me.

Thanks,

--
Ari

\
 
 \ /
  Last update: 2017-05-10 21:20    [W:0.069 / U:0.544 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site